@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/base/svelte.config.js.hbs

@@ -1,30 +1,109 @@
 /**
  * Svelte 配置
  */
-{{#if isCapacitorApp}}
-import adapter from '@sveltejs/adapter-static'
-{{else}}
-import adapter from '@sveltejs/adapter-auto'
+{{#unless isSvelteOnlyApp}}
+import process from 'node:process'
+{{/unless}}
+{{#if hasUi}}
+import { autoImportHaiUi } from '@h-ai/ui/auto-import'
 {{/if}}
+{{#unless isSvelteOnlyApp}}
+import adapter from '@sveltejs/adapter-node'
+{{#if_eq appType 'website'}}
+import staticAdapter from '@sveltejs/adapter-static'
+{{/if_eq}}
+{{/unless}}
 import { vitePreprocess } from '@sveltejs/vite-plugin-svelte'
+{{#unless isSvelteOnlyApp}}
+import { resolvePublicBasePath } from './scripts/public-base-path.mjs'
+{{/unless}}
+{{#if_eq appType 'website'}}
+import { resolveStaticWebsite, validateStaticRoutes } from './scripts/static-website.mjs'
+
+const website = resolveStaticWebsite()
+const staticOutput = staticAdapter({ strict: false })
+{{/if_eq}}
+
+{{#if isSvelteOnlyApp}}
+/** @type {import('@sveltejs/vite-plugin-svelte').SvelteConfig} */
+const config = {
+  preprocess: [{{#if hasUi}}autoImportHaiUi(), {{/if}}vitePreprocess()],
+  compilerOptions: {
+    runes: true,
+  },
+}
+{{else}}
+const DEFAULT_E2E_ORIGINS = ['http://localhost:4173', 'http://127.0.0.1:4173']
+
+function resolveTrustedOrigins() {
+  if (process.env.HAI_E2E !== '1')
+    return []
+
+  const rawBaseUrl = process.env.BASE_URL ?? DEFAULT_E2E_ORIGINS[0]
+
+  try {
+    const url = new URL(rawBaseUrl)
+    const origins = new Set([url.origin])
+
+    if (url.hostname === 'localhost') {
+      url.hostname = '127.0.0.1'
+      origins.add(url.origin)
+    }
+    else if (url.hostname === '127.0.0.1') {
+      url.hostname = 'localhost'
+      origins.add(url.origin)
+    }
+
+    return [...origins]
+  }
+  catch {
+    return DEFAULT_E2E_ORIGINS
+  }
+}
 
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
-  preprocess: vitePreprocess(),
+  preprocess: [{{#if hasUi}}autoImportHaiUi(), {{/if}}vitePreprocess()],
   compilerOptions: {
     runes: true,
   },
   kit: {
+    // 环境文件由 Vite 的 core loader 统一加载；Kit 不再二次读取根目录私有配置。
+    env: { dir: './.svelte-kit' },
+    paths: { base: resolvePublicBasePath() },
 {{#if isCapacitorApp}}
     adapter: adapter({
       pages: 'build',
       assets: 'build',
       fallback: 'index.html',
     }),
+{{else}}
+{{#if_eq appType 'website'}}
+    adapter: website.enabled
+      ? {
+          ...staticOutput,
+          name: 'hai-static-website',
+          async adapt(builder) {
+            // 仅省略模板健康端点；自定义API或未预渲染页面明确失败，不用SPA回退掩盖。
+            validateStaticRoutes(builder.routes)
+            await staticOutput.adapt(builder)
+          },
+        }
+      : adapter(),
 {{else}}
     adapter: adapter(),
+{{/if_eq}}
 {{/if}}
+    csrf: {
+      trustedOrigins: resolveTrustedOrigins(),
+    },
+    alias: {
+      $components: './src/lib/components',
+      $stores: './src/lib/stores',
+      $utils: './src/lib/utils',
+    },
   },
 }
+{{/if}}
 
 export default config

package/templates/base/tests/scaffold.test.ts.hbs

@@ -0,0 +1,102 @@
+{{#unless isSvelteOnlyApp}}
+import type { CoreConfig } from '@h-ai/core'
+{{/unless}}
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+{{#unless isSvelteOnlyApp}}
+import process from 'node:process'
+{{/unless}}
+import { fileURLToPath } from 'node:url'
+{{#unless isSvelteOnlyApp}}
+{{#if features.iam}}
+import { cache } from '@h-ai/cache'
+{{/if}}
+import { core } from '@h-ai/core'
+{{#if features.iam}}
+import { iam } from '@h-ai/iam'
+import { reldb } from '@h-ai/reldb'
+{{/if}}
+{{/unless}}
+import { describe, expect, it } from 'vitest'
+{{#unless isSvelteOnlyApp}}
+import { getKitConfig } from '../src/lib/server/kit-config'
+import { load } from '../src/routes/+layout.server'
+{{/unless}}
+
+const rootDir = fileURLToPath(new URL('..', import.meta.url))
+
+describe('generated scaffold', () => {
+  it('declares project metadata and quality gate scripts', async () => {
+    const packageJsonPath = join(rootDir, 'package.json')
+    const pkg = JSON.parse(await readFile(packageJsonPath, 'utf-8')) as {
+      name: string
+      scripts: Record<string, string>
+    }
+
+    expect(pkg.name).toBe('{{projectName}}')
+    expect(pkg.scripts.typecheck).toBeDefined()
+    expect(pkg.scripts.lint).toBeDefined()
+    expect(pkg.scripts.test).toBeDefined()
+    expect(pkg.scripts['test:e2e']).toBeDefined()
+  })
+
+{{#if isSvelteOnlyApp}}
+  it('renders the Vite app shell entry', async () => {
+    const indexHtml = await readFile(join(rootDir, 'index.html'), 'utf-8')
+    expect(indexHtml).toContain('<div id="app"></div>')
+  })
+{{else}}
+  it('renders the app shell locale marker', async () => {
+    const appHtml = await readFile(join(rootDir, 'src/app.html'), 'utf-8')
+    expect(appHtml).toContain('lang="{{#if hasI18n}}{{#if isCapacitorApp}}{{defaultLocale}}{{else}}%lang%{{/if}}{{else}}{{defaultLocale}}{{/if}}"')
+  })
+{{/if}}
+{{#unless isCapacitorApp}}
+
+  it('ships an application config loaded at startup', async () => {
+    const result = core.config.load<CoreConfig>('core', join(rootDir, 'config/_core.yml'))
+    expect(result.success).toBe(true)
+    if (!result.success)
+      return
+    expect(result.data.name).toBe(process.env.HAI_CORE_NAME ?? '{{projectName}}')
+    expect(result.data.defaultLocale).toBe(process.env.HAI_CORE_DEFAULTLOCALE ?? '{{defaultLocale}}')
+  })
+{{/unless}}
+{{#unless isSvelteOnlyApp}}
+
+  it('publishes only public metadata from parsed core configuration', async () => {
+    core.init({ configDir: './config' })
+    const config = core.config.getOrThrow<CoreConfig>('core')
+    expect(core.logger.getLevel()).toBe(config.logging?.level ?? 'info')
+{{#if features.iam}}
+    // 动态公开策略依赖已初始化的 IAM，使用隔离内存后端，不能用未等待的 Promise 冒充数据。
+    try {
+      const db = await reldb.init({ type: 'sqlite', database: ':memory:' })
+      expect(db.success).toBe(true)
+      const cached = await cache.init({ type: 'memory' })
+      expect(cached.success).toBe(true)
+      const initialized = await iam.init({ seedDefaultData: false })
+      expect(initialized.success).toBe(true)
+      const publicConfig = await iam.getPublicConfig()
+      if (!publicConfig.success)
+        throw new Error(publicConfig.error.message)
+      expect(await load()).toEqual({
+        kitConfig: { transport: getKitConfig().transport },
+        iamPublicConfig: publicConfig.data,
+        appConfig: { name: config.name, version: config.version, env: config.env, defaultLocale: config.defaultLocale },
+      })
+    }
+    finally {
+      await iam.close()
+      await cache.close()
+      await reldb.close()
+    }
+{{else}}
+    expect(await load()).toEqual({
+      kitConfig: { transport: getKitConfig().transport },
+      appConfig: { name: config.name, version: config.version, env: config.env, defaultLocale: config.defaultLocale },
+    })
+{{/if}}
+  })
+{{/unless}}
+})

package/templates/base/tsconfig.json.hbs

@@ -0,0 +1,50 @@
+{{#if isSvelteOnlyApp}}
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "moduleDetection": "force",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "types": ["svelte", "vite/client", "node", "vitest/globals"],
+    "allowJs": true,
+    "checkJs": false,
+    "strict": true,
+    "noEmit": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true
+  },
+  "include": [
+    "src/**/*.ts",
+    "src/**/*.svelte",
+    "tests/**/*.ts",
+    "vite.config.ts",
+    "svelte.config.js"
+  ],
+  "exclude": ["node_modules", "dist", "build", "android", "ios"]
+}
+{{else}}
+{
+  "extends": "./.svelte-kit/tsconfig.json",
+  "compilerOptions": {
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "allowJs": true,
+    "checkJs": false,
+    "strict": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true
+  },
+  "include": [
+    "src/**/*",
+    "src/**/*.svelte"
+  ],
+  "exclude": [
+    "node_modules",
+    ".svelte-kit"
+  ]
+}
+{{/if}}

package/templates/base/vite.config.ts.hbs

@@ -1,27 +1,132 @@
 /**
  * {{projectName}} - Vite 配置
  */
-import { sveltekit } from '@sveltejs/kit/vite'
+{{#if isSvelteOnlyApp}}
+import type { CoreConfig } from '@h-ai/core'
+{{/if}}
+import type { Plugin } from 'vite'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { core } from '@h-ai/core'
 {{#if hasUi}}
-import tailwindcss from '@tailwindcss/vite'
+import { haiOptimizeExclude, haiPrebundledDeps } from '@h-ai/ui/vite'
 {{/if}}
 {{#if hasI18n}}
 import { paraglideVitePlugin } from '@inlang/paraglide-js'
 {{/if}}
+{{#if isSvelteOnlyApp}}
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+{{else}}
+import { sveltekit } from '@sveltejs/kit/vite'
+{{/if}}
+{{#if hasUi}}
+import tailwindcss from '@tailwindcss/vite'
+{{/if}}
 import { defineConfig } from 'vite'
+import { resolveBuildMetadata } from './scripts/build-metadata.js'
+{{#if_eq appType 'website'}}
+import { resolveStaticWebsite } from './scripts/static-website.mjs'
+{{/if_eq}}
+{{#if isSvelteOnlyApp}}
+import { resolvePublicBasePath } from './scripts/public-base-path.mjs'
+import { publicRuntimeConfig } from './scripts/vite-runtime-config.js'
+{{/if}}
+
+export default defineConfig(({ mode, command }) => {
+{{#if_eq appType 'website'}}
+  const website = resolveStaticWebsite()
+{{/if_eq}}
+  const envResult = command === 'build' || process.env.HAI_E2E === '1'{{#if_eq appType 'website'}} || website.enabled{{/if_eq}} ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir: process.cwd() })
+  if (!envResult.success)
+    throw new Error(envResult.error.message)
+  const env = envResult.data
+  Object.assign(process.env, env)
+  const buildMetadata = resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))
+  const metadataAsset: Plugin = {
+    name: 'hai-build-metadata',
+    generateBundle() {
+      this.emitFile({ type: 'asset', fileName: 'build-metadata.json', source: JSON.stringify(buildMetadata) })
+    },
+  }
+{{#if isSvelteOnlyApp}}
+  // 浏览器无法读取 YAML；构建时通过 core 解析，仅注入明确可公开的字段。
+  core.init({ configDir: './config' })
+  const config = core.config.getOrThrow<CoreConfig>('core')
+  const appConfig = {
+    name: config.name,
+    version: config.version,
+    env: config.env,
+    defaultLocale: config.defaultLocale,
+    logging: config.logging ? { level: config.logging.level, format: config.logging.format } : undefined,
+  }
+  const publicBase = resolvePublicBasePath()
+{{/if}}
 
-export default defineConfig({
-  plugins: [
-    sveltekit(),
+  return {
+{{#if isSvelteOnlyApp}}
+    base: publicBase ? `${publicBase}/` : './',
+{{/if}}
+    envDir: false,
+    envPrefix: ['VITE_', 'PUBLIC_'],
+    define: {
+      __HAI_BUILD_METADATA__: JSON.stringify(buildMetadata),
+{{#if_eq appType 'website'}}
+      __HAI_BUILD_STATIC__: JSON.stringify(website.enabled),
+{{/if_eq}}
+{{#if isSvelteOnlyApp}}
+      __APP_CORE_CONFIG__: JSON.stringify(appConfig),
+{{/if}}
+    },
+    plugins: [
+      metadataAsset,
+{{#if_eq appType 'website'}}
+      {
+        name: 'hai-static-website-assets',
+        generateBundle() {
+          if (!website.enabled)
+            return
+          this.emitFile({ type: 'asset', fileName: '.nojekyll', source: '' })
+        },
+      },
+{{/if_eq}}
+  {{#if isSvelteOnlyApp}}
+      publicRuntimeConfig({ apiBase: process.env.PUBLIC_API_BASE, {{#if features.crypto}}apiTransport: process.env.PUBLIC_API_TRANSPORT, apiKeyExchangePath: process.env.PUBLIC_API_KEY_EXCHANGE_PATH, {{/if}}core: appConfig }),
+      svelte(),
+  {{else}}
+      sveltekit(),
+  {{/if}}
 {{#if hasUi}}
-    tailwindcss(),
+      tailwindcss(),
 {{/if}}
 {{#if hasI18n}}
-    paraglideVitePlugin({
-      project: './project.inlang',
-      outdir: './src/lib/paraglide',
-      strategy: ['cookie', 'baseLocale'],
-    }),
+      paraglideVitePlugin({
+        project: './project.inlang',
+        outdir: './src/lib/paraglide',
+        strategy: ['cookie', 'baseLocale'],
+      }),
+{{/if}}
+    ],
+{{#if hasUi}}
+    optimizeDeps: {
+      // bits-ui 含 .svelte 源码须 exclude；@internationalized/date 须与 bits-ui 同为原始副本，
+      // 避免日期类型 instanceof 失败（"Unknown date type"）。
+      exclude: [...haiOptimizeExclude],
+      // 预打包 @h-ai/ui 的重型纯 JS 依赖，避免首次进入业务路由触发依赖再优化与整页刷新
+      include: [...haiPrebundledDeps],
+    },
 {{/if}}
-  ],
+{{#unless isSvelteOnlyApp}}
+    ssr: {
+      noExternal: ['@h-ai/ui', '@h-ai/kit'],
+      // sm-crypto 同时列入生产依赖，避免 adapter-node 再次打包其动态 require。
+      external: ['@h-ai/core', 'sm-crypto'],
+    },
+{{/unless}}
+    server: {
+      fs: {
+        allow: [path.resolve(process.cwd())],
+      },
+    },
+  }
 })

package/templates/base/vitest.config.ts.hbs

@@ -0,0 +1,19 @@
+import { fileURLToPath } from 'node:url'
+{{#unless isSvelteOnlyApp}}
+import { sveltekit } from '@sveltejs/kit/vite'
+{{/unless}}
+import { defineConfig } from 'vitest/config'
+import { resolveBuildMetadata } from './scripts/build-metadata.js'
+
+export default defineConfig({
+{{#unless isSvelteOnlyApp}}
+  plugins: [sveltekit()],
+{{/unless}}
+  define: { __HAI_BUILD_METADATA__: JSON.stringify(resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))) },
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    exclude: ['e2e/**'],
+  },
+})

package/templates/features/ai/routes/api/chat/+server.ts

@@ -4,23 +4,22 @@
 import type { RequestHandler } from './$types'
 import { ai } from '@h-ai/ai'
 import { kit } from '@h-ai/kit'
+import { z } from 'zod'
 
-export const POST: RequestHandler = async ({ request, locals }) => {
-  const { message } = await request.json()
+const ChatInputSchema = z.object({ message: z.string().trim().min(1).max(4000) }).strict()
 
-  if (!message) {
-    return kit.response.badRequest('message is required')
-  }
+export const POST: RequestHandler = kit.handler(async ({ request, locals }) => {
+  const { message } = await kit.validate.body(request, ChatInputSchema)
 
   const result = await ai.llm.ask(message, {
     systemPrompt: 'You are a helpful assistant.',
   })
 
   if (!result.success) {
-    return kit.response.internalError(result.error.message)
+    return kit.response.fromError(result.error, locals.requestId)
   }
 
   return kit.response.ok({
     reply: result.data,
   }, locals.requestId)
-}
+})

package/templates/features/iam/routes-admin/(auth)/+layout.svelte.hbs

@@ -1,21 +1,7 @@
-{{!-- 认证布局（登录/注册共用） --}}
-<script lang="ts">
-  /**
-   * 认证布局（登录/注册共用）
-   */
+<script lang='ts'>
   import type { Snippet } from 'svelte'
 
-  interface Props {
-    children: Snippet
-  }
-
-  let { children }: Props = $props()
+  const { children }: { children: Snippet } = $props()
 </script>
 
-<div class="min-h-screen flex items-center justify-center bg-base-200">
-  <div class="card w-full max-w-md bg-base-100 shadow-xl">
-    <div class="card-body">
-      {@render children()}
-    </div>
-  </div>
-</div>
+{@render children()}

package/templates/features/iam/routes-admin/(auth)/auth/forgot-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='forgot' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-admin/(auth)/auth/login/+page.svelte.hbs

@@ -1,98 +1,11 @@
-{{!-- Admin 登录页面 --}}
-<script lang="ts">
-  /**
-   * 登录页面
-   */
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-
-  let username = $state('')
-  let password = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleLogin() {
-    error = ''
-    loading = true
-    try {
-      const res = await fetch('/api/auth/login', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, password }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/admin'
-      } else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_login_failed()
-{{else}}
-        error = data.error?.message || '登录失败'
-{{/if}}
-      }
-    } catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    } finally {
-      loading = false
-    }
-  }
+<script lang='ts'>
+  import { goto } from '$app/navigation'
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_login_title()}</title>
-{{else}}
-  <title>登录</title>
-{{/if}}
-</svelte:head>
-
-{{#if hasI18n}}
-<h2 class="card-title justify-center mb-4">{m.auth_login_title()}</h2>
-{{else}}
-<h2 class="card-title justify-center mb-4">登录</h2>
-{{/if}}
-
-{#if error}
-  <div class="alert alert-error mb-4">
-    <span>{error}</span>
-  </div>
-{/if}
-
-<form onsubmit={(e) => { e.preventDefault(); handleLogin() }} class="space-y-4">
-  <div class="form-control">
-{{#if hasI18n}}
-    <label class="label" for="username"><span class="label-text">{m.auth_label_username()}</span></label>
-{{else}}
-    <label class="label" for="username"><span class="label-text">用户名</span></label>
-{{/if}}
-    <input id="username" type="text" class="input input-bordered w-full" bind:value={username} required />
-  </div>
-  <div class="form-control">
-{{#if hasI18n}}
-    <label class="label" for="password"><span class="label-text">{m.auth_label_password()}</span></label>
-{{else}}
-    <label class="label" for="password"><span class="label-text">密码</span></label>
-{{/if}}
-    <input id="password" type="password" class="input input-bordered w-full" bind:value={password} required />
-  </div>
-  <button type="submit" class="btn btn-primary w-full" disabled={loading}>
-{{#if hasI18n}}
-    {loading ? m.auth_login_loading() : m.auth_login_submit()}
-{{else}}
-    {loading ? '登录中...' : '登录'}
-{{/if}}
-  </button>
-</form>
-
-<div class="text-center mt-4">
-{{#if hasI18n}}
-  <a href="/auth/register" class="link link-primary text-sm">{m.auth_login_to_register()}</a>
-{{else}}
-  <a href="/auth/register" class="link link-primary text-sm">没有账号？立即注册</a>
-{{/if}}
-</div>
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='login' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/admin', {}))} />